Enterprise QoS Solution Reference Network Design Guide

Chapter 6 IPSec VPN QoS Design
Version 3.3
Site-to-Site V3PN QoS Considerations
However, IPSec VPNs present many unique considerations for QoS design, including the following
(each is discussed in detail throughout the rest of the chapter):
IPSec VPN modes of operation
Packet overhead increases because of encryption
cRTP and IPSec incompatibility
Prefragmentation
Bandwidth provisioning
Logical topologies
Delay budget increases because of encryption
ToS byte preservation
QoS Pre-Classify feature
Pre-encryption queuing
Anti-Replay implications
Control plane provisioning
IPSec VPN Modes of Operation
Three principal modes of IPSec VPN operation exist:
IPSec Tunnel Mode (No IP GRE Tunnel)
IPSec Transport Mode with an Encrypted IP GRE Tunnel
IPSec Tunnel Mode with an Encrypted IP GRE Tunnel
The advantages, disadvantages, features, and limitations of these options are discussed next.
IPSec Tunnel Mode (No IP GRE Tunnel)
This option does not utilize an IP GRE tunnel. With this option, only IPSec unicast traffic can be
transported. (IP multicast traffic cannot be transported between IPSec peers without configuring an IP
GRE tunnel.)
This configuration might be sufficient to support application requirements; its advantage lies in lower
CPU overhead (primarily at the headend IPSec VPN router) compared with alternative IPSec design
options.
IPSec security associations (SAs) are created for each access list line matched. An access list must be
specified in the crypto map to designate packets that are to be encrypted. Such an access list typically
entails several lines to define the application(s) to be encrypted by the five ACL tuples:
source/destination IP address, protocol, and source/destination port numbers. When not encrypting a
GRE tunnel, it is possible to create a separate SA for each application or access-list line match or to
create an SA that carries all traffic that matches an ACL range (which is recommended). Each SA has
its own Encryption Security Protocol (ESP) or Authentication Header (AH) sequence number.
Anti-Replay drops can be eliminated or minimized by constructing access lists that create a separate
security association for each class of traffic being influenced by per-hop QoS policies. (Anti-Replay is
an IPSec standard feature that discards packets that fall outside a receiver’s 64-byte sliding window
because such packets are considered suspect or potentially compromised—it is discussed in greater
detail later in this chapter.)
Enterprise QoS Solution Reference Network Design Guide
6-3